The process of determining what actions or resources an authenticated identity is permitted to access. Defines 'what you can do' based on policies and permissions.